Vaneform
by jiangqizheng · remote · no sign-in to list tools · v1.4.3 · published by GitHub user jiangqizheng
Free website traffic checker: monthly visits, traffic sources, top countries and domain compares.
10 tools: 4 change things and 6 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things4Claude Code: ask: see these tools
- Only reads6Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http vaneform https://vaneform.com/mcp --header 'Authorization: <your-authorization>'Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
10 tools
Changes things 4Claude Code: ask
manage_researchManage the caller private research: remove a saved target, pause/resume or change daily/weekly monitoring, remove a monitor, check current public data, or mark a change notificatio…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Manage the caller private research: remove a saved target, pause/resume or change daily/weekly monitoring, remove a monitor, check current public data, or mark a change notification read. Use IDs from get_research_workspace. Free; 0 credits.
monitor_researchMonitor a Google Ads or AdSense query daily or weekly.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Monitor a Google Ads or AdSense query daily or weekly. Record newly observed public ads and connected sites as private in-app notifications. The first successful observation establishes a baseline. Free; 0 credits.
research_siteFree early-access standalone site research.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Free early-access standalone site research. Query Google ads by domain or advertiser, public Meta ads by keyword, AdSense accounts/related sites, outbound page links, collected ad text, recorded website opportunities or DR changes. Source acquisition is explicit and bounded; all these tools spend 0 credits. Ad text and Publisher ID reverse lookups cover the recorded collection. Estimates and observations retain dates, scope and confidence.
save_researchSave a standalone site-tool query in the caller workspace, with a folder and private notes.No findings
Why it is in this group
- The name "save_research" says "save": a word for a change.
Description, as the server wrote it Save a standalone site-tool query in the caller workspace, with a folder and private notes. Free; 0 credits.
Only reads 6Claude Code: allow
compare_bulkCompare domains side by side.No findings
Why it is in this group
- The name "compare_bulk" says "compare": a word for reading.
Description, as the server wrote it Compare domains side by side. Returns scale and registry. Fetches traffic when monthly visits are missing. Spends 1 credit per compared domain with data. Up to 3 domains on Free, 30 on Pro. Use for 批量对比.
compare_tldCompare the same registrable name across suffixes.No findings
Why it is in this group
- The name "compare_tld" says "compare": a word for reading.
Description, as the server wrote it Compare the same registrable name across suffixes. Default suffixes are com,ai,io. example.com is read as example. Response suffixes and items follow a fixed suffix order; match the returned suffixes. Fetches traffic when monthly visits are missing. Spends 1 credit per compared domain with data. Use for 后缀对比.
get_accountRead the caller plan, website lookup allowance, and credit balance.Reads text others writeNo findings
Why it is in this group
- The name "get_account" says "get": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "read" and "website": it reads web pages, which anyone can write.
Description, as the server wrote it Read the caller plan, website lookup allowance, and credit balance. This call spends 0. Use before a batch.
get_research_workspaceRead the caller saved research, folders, private notes, tool history, publisher/ad monitors and in-app change notifications.Reads private dataNo findings
Why it is in this group
- The name "get_research_workspace" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "read" and "folder": it reads files.
Description, as the server wrote it Read the caller saved research, folders, private notes, tool history, publisher/ad monitors and in-app change notifications. Free; 0 credits. Account ownership comes from the authenticated key.
lookup_domainRead a cached Vaneform domain snapshot: scale (full-site or search visits), registry, site profile, and link-rank popularity.No findings
Why it is in this group
- The name "lookup_domain" says "lookup": a word for reading.
Description, as the server wrote it Read a cached Vaneform domain snapshot: scale (full-site or search visits), registry, site profile, and link-rank popularity. Optional include=baidu is cached Baidu rank. Optional include=search is Pro-only keyword rankings (ranked keywords, landing pages, search competitors) from this month's cache. Cache-only: status=missing means not cached, not zero traffic. Use for 查网站, 访问量, how big a site is, domain visits, registry age, backlink rank, 百度权重, or 关键词排名. A new ready or partial domain spends 1 credit, or 10 when include=search finds no saved ranking or a saved ranking whose status is ready. include=search spends 0 when that saved status is missing, error, or partial.
lookup_keywordRead a US/EN keyword brief: monthly searches, difficulty, CPC, and Google occupancy.No findings
Why it is in this group
- The name "lookup_keyword" says "lookup": a word for reading.
Description, as the server wrote it Read a US/EN keyword brief: monthly searches, difficulty, CPC, and Google occupancy. Pro-only. At most 30 Google results. A cache hit is free; a successful miss spends 60 credits. After trimming, longer than 200 characters is invalid. Matching uses the lowercased, space-collapsed first 80 characters. Use for 关键词查询.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.
- Reads private data1
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write1
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Install
Pinned to version 1.4.3. Values in angle brackets are yours to fill in.
claude mcp add --transport http vaneform https://vaneform.com/mcp --header 'Authorization: <your-authorization>'Run in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__vaneform__get_research_workspace",
"mcp__vaneform__lookup_domain",
"mcp__vaneform__get_account",
"mcp__vaneform__lookup_keyword",
"mcp__vaneform__compare_bulk",
"mcp__vaneform__compare_tld"
],
"ask": [
"mcp__vaneform__research_site",
"mcp__vaneform__save_research",
"mcp__vaneform__monitor_research",
"mcp__vaneform__manage_research"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as vaneform. Review it before you use it.
Capability tags behind 2 rules
- mcp__vaneform__get_research_workspace private-data
- mcp__vaneform__get_account untrusted-input